What Happened
Palo Alto Networks patched CVE-2026-0322, a CVSS 8.6 remote code execution flaw in the PAN-OS management interface. The Hacker News reports an authenticated attacker with network access runs arbitrary code as root. PA-Series and VM-Series firewalls and Panorama are affected. Cloud NGFW and Prisma Access are not.
No special configuration is required. Palo Alto Networks reports limited exploitation of the management interface. The company did not name the attackers, give a start date, or describe their actions. It linked the attempts to three US-geolocated IP addresses: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. CISA added the flaw to its KEV catalog on October 14 with an October 17 federal deadline. Fixed builds exist across the 12.2, 12.1, 11.2, 11.1, and 10.2 trains, and the vendor advisory lists the exact release for each.
Why This Matters for Canadian Organizations
PAN-OS firewalls guard provincial networks, municipalities, hospitals, utilities, and financial institutions across Canada. The authentication requirement offers little comfort. Stolen administrator credentials are common, and infostealer logs supply them in volume. Root access on a firewall hands an attacker control of traffic inspection, VPN sessions, and stored secrets.
Exposed management interfaces have driven repeated PAN-OS incidents. Canadian teams following Cyber Centre baseline controls already restrict management access, but audits still find interfaces open to broad address ranges. Regulated entities also owe a timely response under OSFI B-13 and PIPEDA safeguards.
What to Do
Restrict management interface access to trusted internal addresses. Place a jump box in front, and allow only this system to reach the interface. Apply the fixed build for your release train. Search firewall and authentication logs for the three listed addresses and for unexpected administrator logins. Rotate administrator credentials and review local accounts and API keys. Follow our TechTalk coverage for further vulnerability analysis.
